How to deal with old roles with the same but no restriction after a new role with restriction?

[sallyxu-cn]

Hi SAP Guru,

I am a functional consultant and for only enabling authorized users to change PM orders, one of the options is to limit planner group (equipment master) + PM Order type.

Authorization Object   I_INGRP  ---- Planner Group

Authorization Object   I_AUART -------Order type

However there are many role with no restrictions to these 2 authorization objects

My question is:

After a new role is created for the proper limitation, how do we deal with the old roles which have no restriction?  The users with those roles are still able to access.

Please kindly help,

Sally

.